ci: add reproducible supply-chain gates

2026-08-17 16:37:30 +02:00 · 2026-08-14 12:27:15 -04:00
parent eec8a615f7
commit e7b658c0c8
13 changed files with 5393 additions and 44 deletions
@@ -3,3 +3,5 @@ action  actions/checkout         3d3c42e5aac5ba805825da76410c181273ba90b1
 action  actions/setup-python     5fda3b95a4ea91299a34e894583c3862153e4b97                              v7.0.0            2026-08-14   baseline pin (#59)
 action  actions/upload-artifact  043fb46d1a93c77aae656e7c1c64a875d1fc6a0a                              v7.0.1            2026-08-14   test/package evidence (#64, #65)
 tool    rhysd/actionlint          sha256:8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  v1.7.12           2026-08-14   workflow syntax/policy gate (#65)
+tool    astral-sh/uv              pypi:0.12.4                                                        v0.12.4           2026-08-14   locked dependency and SBOM engine (#66)
+tool    gitleaks/gitleaks         sha256:551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  v8.30.1           2026-08-14   redacted checkout secret scan (#66)
@@ -0,0 +1,53 @@
+{
+  "schema_version": 1,
+  "vulnerability": {
+    "decision": "fail-all-severities",
+    "severity_handling": "OSV does not guarantee a normalized severity, so every reported vulnerability is blocking unless an unexpired exception matches it.",
+    "fail_severities": [
+      "unknown",
+      "low",
+      "medium",
+      "high",
+      "critical"
+    ],
+    "max_fixed_suppression_days": 7,
+    "max_unfixed_suppression_days": 90,
+    "suppressions": []
+  },
+  "secret": {
+    "decision": "fail-all-findings",
+    "report_redaction_percent": 100,
+    "max_suppression_days": 30,
+    "suppressions": []
+  },
+  "license": {
+    "decision": "exact-allow-list",
+    "excluded_packages": [
+      "obliteratus"
+    ],
+    "allowed_expressions": [
+      "Apache 2.0 License",
+      "Apache License 2.0",
+      "Apache Software License",
+      "Apache Software License; BSD License",
+      "Apache-2.0",
+      "Apache-2.0 AND Apache-2.0 WITH LLVM-exception AND BSD-2-Clause AND BSD-3-Clause AND BSL-1.0 AND MIT",
+      "Apache-2.0 AND CNRI-Python",
+      "Apache-2.0 AND MIT",
+      "Apache-2.0 OR BSD-2-Clause",
+      "BSD License",
+      "BSD-2-Clause",
+      "BSD-3-Clause",
+      "BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0",
+      "ISC License (ISCL)",
+      "MIT",
+      "MIT License",
+      "MIT-CMU",
+      "MPL-2.0 AND (Apache-2.0 OR MIT)",
+      "MPL-2.0 AND MIT",
+      "Mozilla Public License 2.0 (MPL 2.0)",
+      "PSF-2.0",
+      "Python Software Foundation License"
+    ]
+  }
+}